Freedom of Information Act 2000 Request

Information on data breaches by the CPS

Request

I write with a request for information under the FOIA as follows:

1. Please disclose the number of (suspected) data breaches by the CPS in 2019 and to date in 2020;
2. A description of each breach, the outcome, including any action taken, including disciplinary action, how many staff were affected/potentially affected by the breach.

Response

The Crown Prosecution Service (CPS) records data breaches by financial year. Data pertaining to financial year 2018/19 is published on the CPS Annual Report and Accounts and is therefore withheld from disclosure under section 21 of the FOI Act – Information accessible by other means. Data pertaining to financial year 2019/20 is due to be published, and therefore this data is withheld under section 22(1) of the FoIA - Information intended for future publication. Please see the attached section 17 notice which explains these exemptions in further detail.

The CPS Annual Report and Accounts contains data pertaining to all data breaches reported to the Departmental Security Unit (DSU), broken down by breach type and whether the breach was ‘Included or Excluded’. Where the explanatory note indicates that the breach was ‘excluded’ on the report, this indicates that the breach was contained.

Data breach information can be located within the Annual Report and Accounts 2018-19 via the link below on page 41.

https://www.cps.gov.uk/publication/cps-annual-report-2018-19

The CPS Departmental Security Unit (DSU) does not keep a record of what action was taken against any individual as part of its breach investigation; such information is held on individual personnel files. The role of DSU in breach management is to ensure timeliness of reporting and prompt action to mitigate the possible impact of the breach.

In order to provide the information sought in part two of your request, a manual review of each recorded breach during the specified timeframe would be required.

Section 12(1) of the FOI Act means public authorities are not obliged to comply with a request for information if it estimates the cost of complying would exceed the appropriate limit. The appropriate limit for central government is set at £600. This represents the estimated cost of one person spending 3.5 working days determining whether the department holds the information, and locating, retrieving and extracting the information.

We believe that the cost of manually reviewing records pertaining to each data breach would exceed the appropriate limit. Consequently, we are not obliged to comply with part two your request.

Information Management Unit 020 3357 0788 IMU@cps.gov.uk